1. Jean-Pierre Garitte Skopje 8 April 2019
PEM PAL IA COP Audit in Practice Working Group Introduction to the field work
Jean-Pierre Garitte
Skopje
8 April 2019

2. Agenda Part 1: Review on where we are
Part 2: The components of the field work
Part 3: Reference to the ISPPIA
Part 4: How does field work connect to our planning?

3. Agenda Part 1: Review on where we are
Part 2: The components of the field work
Part 3: Reference to the ISPPIA
Part 4: How does field work connect to our planning?

4. 1 2 3 4 5 6 Audit cycle is a rather generic process Planning Execution
Preliminary
Survey
Fieldwork
Reporting
Action Plan
(includes quality
satisfaction)
Follow-Up
Planning
Execution
Reporting
Rule of thumb:
20% for planning and preliminary survey (1, 2)
60% for fieldwork (3)
20% for reporting (4)

5. 1 2 3 4 5 6 Planning Scheduling of the engagement
Preliminary
Survey
Fieldwork
Reporting
Action Plan
Follow-up
Scheduling of the engagement
Announcement of the engagement
Opening meeting

6. 1 2 3 4 5 6 Preliminary Survey Desk review Risk (re-)assessment
Planning
Preliminary
Survey
Fieldwork
Reporting
Action Plan
Follow-Up
Desk review
Risk (re-)assessment
Engagement planning memorandum
Preparation of audit program
Kick-off meeting with auditee

7. Agenda Part 1: Review on where we are
Part 2: The components of the field work
Part 3: Reference to the ISPPIA
Part 4: How does field work connect to our planning?

8. 1 2 3 4 5 6 Fieldwork Detailed review of internal control system
Planning
Preliminary
Survey
Fieldwork
Reporting
Action Plan
Follow-Up
Detailed review of internal control system
Test of control design
Test of operating effectiveness
Formalising observations
Validation meeting

9. Activities Processes under review Management’s Objectives
Fieldwork
Detailed review of the internal control system
Reviewing the activities, processes, management's objectives, risks, and internal controls
Are we responding to risk in the right way?
Are these being achieved?
Activities Processes under review
Management’s Objectives
Risks
What is the internal control system?
Risk Response
Are these being managed?
Effective?
Mitigating Controls

10. Activities Processes under review Management’s Objectives
The Fieldwork – Step A
A Detailed review of the Internal Control System
Review of the activities, processes, objectives of management, risks and internal controls
Activities Processes under review
Management’s Objectives
Risks
Risk Response
Internal Controls
Take into account the control framework.

11. Assessment of Internal Controls
The Fieldwork – Step B
B Test of Design adequacy
Are the internal controls adequate to mitigate the risks?
Assessment of Internal Controls
Finding
Strong Control ? No E E E
Yes C C
Auditors will identify strengths to be tested (in D)
C = Analysis of strengths and weaknesses
E = Observation form

12. Confirmed Strong Internal Control
The Fieldwork – Step D
D Tests of Implementation effectiveness
Do the internal controls work effectively as they are designed? C
Finding E E
Tests of Detail
Confirmed Strong Internal Control
May be recorded in Audit Report
Applied in
practice ? No
Yes

13. The Fieldwork – Step F F Validation meeting
A formal validation meeting with the auditee (normally at Management level for the process being audited) is organised no later than xxx days/weeks following the end of the fieldwork.
The aim is to reach, during the formal validation meeting, an agreement, at the appropriate hierarchical level, on the facts, which will not be reopened or questioned again in the reporting stages of the audit.
It is not a conclusion but an opportunity and should allow for the necessary understanding in order to prepare the report and the final conclusions.

14. The reasoning behind a recommendation
Criteria
What should exist - The standards, measures, or expectations used in making an evaluation and/or verification
Condition
What does exist - The factual evidence that the auditor found in the course of the examination
Cause (Root)
Why the difference exists - The (real) reason for the difference between the expected and actual conditions
Consequence (Effect)
The impact of the difference - The risk or exposure the organisation and/or others encounter because the condition is not consistent with the criteria
Recommendation
What, Who and When ? - Action linked to responsible, date/timing, priority, and severity
Management Response
Yes, agree / Yes, but alternative / No, disagree

15. Agenda Part 1: Review on where we are
Part 2: The components of the field work
Part 3: Reference to the ISPPIA
Part 4: How does field work connect to our planning?

16. 2300 – Engagement Performance
ISPPIA 2300
2300 – Engagement Performance
2201 – Identifying Information
2210 – Analysis and Evaluation
2220 – Recording Information
2230 – Engagement Supervision

17. Standard 2300 – Performing the engagement
“Internal auditors must identify, analyze, evaluate, and document sufficient information to achieve the engagement’s objectives.”

18. Standard 2310 – Identifying information
“Internal auditors must identify sufficient, reliable, relevant and useful information to achieve the engagement’s objectives.”
Interpretation:
Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Reliable information is the best attainable information through the use of appropriate engagement techniques. Relevant information supports engagement observations and recommendations and is consistent with the objectives for the engagement. Useful information helps the organization meet its goals.

19. Standard 2320 – Analysis and Evaluation
“Internal auditors must base conclusions and engagement results on appropriate analyses and evaluations.”

20. Standard 2330 – Documenting Information
“Internal auditors must document sufficient, reliable, relevant, and useful information to support the engagement results and conclusions.”

21. Standard 2340 – Engagement supervision
“Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff is developed.”
Interpretation:
The extent of supervision required will depend on the proficiency and experience of internal auditors and the complexity of the engagement. The chief audit executive has overall responsibility for supervising the engagement, whether performed by or for the internal audit activity, but may designate appropriately experienced members of the internal audit activity to perform the review. Appropriate evidence of supervision is documented and retained.

22. Agenda Part 1: Review on where we are
Part 2: The components of the field work
Part 3: Reference to the ISPPIA
Part 4: How does field work connect to our planning?

23. Risk / control matrix (1)

24. Risk / control matrix (2)
Name of (sub)process
Inherent risk(s) to (sub)process
Risk rating
Expected mitigating controls
Tests of control design
Conclusion on control adequacy
Tests of control implementation
Conclusion on control effectiveness
Overall conclusion

25. Field work (1)
Develop necessary steps to assess the design of controls
Execute the steps to assess the design of controls
Discuss the observations on the design of controls with auditees
Conclude on the adequacy of controls
Submit working papers for review

26. Field work (2)
Develop tests to assess the effective implementation of controls
Execute the tests to assess the effectiveness of controls
Discuss the observations resulting from the tests of controls with auditees
Conclude on the effectiveness of controls
Submit working papers for review

27. Field work (3)
Prepare overall conclusions with regard to adequacy and effectiveness of controls
Submit working papers for review

28. Questions & Answers